exploit the possibilities

Adobe Flash Player Matrix3D Integer Overflow Code Execution

Adobe Flash Player Matrix3D Integer Overflow Code Execution
Posted Sep 11, 2012
Authored by Nicolas Joly, VUPEN | Site vupen.com

VUPEN Vulnerability Research Team discovered a critical vulnerability in Adobe Flash Player. The vulnerability is caused by an integer overflow error in the "copyRawDataTo()" method within the "Matrix3D" class when processing malformed arguments, which could allow remote attackers execute arbitrary code via a specially crafted web page. Adobe Flash Player versions 11.3.300.271 and prior are affected.

tags | advisory, remote, web, overflow, arbitrary
MD5 | 6a21b0aa29298581091d0eede9499d29

Adobe Flash Player Matrix3D Integer Overflow Code Execution

Change Mirror Download
VUPEN Security Research - Adobe Flash Player "Matrix3D" Integer Overflow
Code Execution (APSB12-19)

Website : http://www.vupen.com/english/research.php

Twitter : http://twitter.com/vupen


I. BACKGROUND
---------------------

Adobe Flash Player is a cross-platform browser-based application runtime
that delivers uncompromised viewing of expressive applications, content,
and videos across screens and browsers. It is installed on 98% of computers.


II. DESCRIPTION
---------------------

VUPEN Vulnerability Research Team discovered a critical vulnerability
in Adobe Flash Player.

The vulnerability is caused by an integer overflow error in the
"copyRawDataTo()" method within the "Matrix3D" class when processing
malformed arguments, which could allow remote attackers execute arbitrary
code via a specially crafted web page.

CVSS Score: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


III. AFFECTED PRODUCTS
---------------------------

Adobe Flash Player version 11.3.300.271 and prior


IV. Binary Analysis & Exploits/PoCs
---------------------------------------

In-depth technical analysis of the vulnerability and a fully functional
exploit including ASLR/DEP bypass are available through the VUPEN BAE
(Binary Analysis & Exploits) portal:

http://www.vupen.com/english/services/ba-index.php

VUPEN Binary Analysis & Exploits Service provides private exploits and
in-depth technical analysis of the most significant public vulnerabilities
based on disassembly, reverse engineering, protocol analysis, and code
audit.

The service allows governments and major corporations to evaluate risks, and
protect infrastructures and assets against new threats. The service also
allows security vendors (IPS, IDS, AntiVirus) to supplement their internal
research efforts and quickly develop both vulnerability-based and
exploit-based signatures to proactively protect their customers from attacks
and emerging threats.


V. VUPEN Threat Protection Program
-----------------------------------

Governments and major corporations which are members of the VUPEN Threat
Protection Program (TPP) have been proactively alerted about the
vulnerability
when it was discovered by VUPEN in advance of its public disclosure, and
have received a detailed attack detection guidance to protect national and
critical infrastructures against potential 0-day attacks exploiting this
vulnerability:

http://www.vupen.com/english/services/tpp-index.php


VI. SOLUTION
----------------

Upgrade to Adobe Flash Player 11.4.402.265


VII. CREDIT
--------------

This vulnerability was discovered by Nicolas Joly of VUPEN Security


VIII. ABOUT VUPEN Security
---------------------------

VUPEN is the leadering provider of advanced vulnerability research for
defensive and offensive cyber security. VUPEN solutions enable corporations
and governments to measure and manage risks, eliminate vulnerabilities
before they can be exploited, and protect critical infrastructures and
assets against known and unknown vulnerabilities.

VUPEN has been recognized as "Company of the Year 2011 in the Vulnerability
Research Market" by Frost & Sullivan.

VUPEN solutions include:

* VUPEN Binary Analysis & Exploits Service (BAE) :
http://www.vupen.com/english/services/ba-index.php

* VUPEN Threat Protection Program (TPP) :
http://www.vupen.com/english/services/tpp-index.php


IX. REFERENCES
----------------------

http://www.adobe.com/support/security/bulletins/apsb12-19.html
http://www.vupen.com


X. DISCLOSURE TIMELINE
-----------------------------

2012-01-25 - Vulnerability Discovered by VUPEN and shared with customers
2012-08-21 - Public disclosure
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close